@yemi33/minions 0.1.2421 → 0.1.2422

package/dashboard/js/settings.js

@@ -595,6 +595,21 @@ async function openSettings() {
       'Permission bypass is runtime-owned: Claude agents use <code>--dangerously-skip-permissions</code>; Copilot agents use <code>--autopilot --allow-all --no-ask-user</code>. There is no dashboard permission-mode setting.' +
     '</div>';
 
+  const paneCodex =
+    '<h3>Codex Tuning</h3>' +
+    '<div class="settings-pane-sub">Command Center and doc-chat need broader host access than dispatched agents. This setting only affects Codex-backed CC calls.</div>' +
+    '<div class="settings-grid-2">' +
+      '<div data-search="codex command center doc chat sandbox danger full access workspace write read only">' +
+       '<label style="font-size:var(--text-sm);color:var(--muted);display:block;margin-bottom:2px">CC sandbox</label>' +
+       '<select id="set-codexCcSandbox" style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:var(--text-md)">' +
+         '<option value="danger-full-access"' + ((e.codexCcSandbox || 'danger-full-access') === 'danger-full-access' ? ' selected' : '') + '>danger-full-access (default)</option>' +
+         '<option value="workspace-write"' + (e.codexCcSandbox === 'workspace-write' ? ' selected' : '') + '>workspace-write</option>' +
+         '<option value="read-only"' + (e.codexCcSandbox === 'read-only' ? ' selected' : '') + '>read-only</option>' +
+       '</select>' +
+       '<div style="font-size:var(--text-xs);color:var(--muted);margin-top:4px"><strong>Security:</strong> <code>danger-full-access</code> lets Codex CC reach localhost Minions APIs and operator-authorized paths outside <code>~/.minions</code>. Dispatched Codex agents and non-CC calls remain <code>workspace-write</code>. The adapter emits an explicit <code>--sandbox</code> CLI flag, which takes precedence over Codex config-file values.</div>' +
+      '</div>' +
+    '</div>';
+
   const paneHarness =
     '<h3>Native Runtime Integration</h3>' +
     '<div class="settings-pane-sub">Repository instructions, skills, commands, and MCPs are discovered by the selected CLI in the dispatched checkout. Minions does not inject or suppress them.</div>' +
@@ -735,6 +750,7 @@ async function openSettings() {
     { id: 'features', label: 'Feature Flags', html: paneFeatures },
     { id: 'copilot', label: 'Copilot Tuning', html: paneCopilot, group: 'advanced' },
     { id: 'claude', label: 'Claude Tuning', html: paneClaude, group: 'advanced' },
+    { id: 'codex', label: 'Codex Tuning', html: paneCodex, group: 'advanced' },
     { id: 'budget', label: 'Budget', html: paneBudget, group: 'advanced' },
     { id: 'advanced', label: 'Advanced', html: paneAdvanced, group: 'advanced' },
   ];
@@ -1536,6 +1552,7 @@ async function saveSettings() {
       ccCli: (document.getElementById('set-ccCli')?.value ?? '').trim(),
       ccModel: (document.getElementById('set-ccModel')?.value ?? '').trim(),
       ccEffort: document.getElementById('set-ccEffort').value || null,
+      codexCcSandbox: document.getElementById('set-codexCcSandbox')?.value || 'danger-full-access',
       ccTurnTimeoutMs: document.getElementById('set-ccTurnTimeoutMs')?.value,
       // Settings UI presents the idle timeout in minutes for readability; the
       // engine stores ms (ENGINE_DEFAULTS.ccWorkerIdleTimeoutMs). Convert here;

package/dashboard.js

@@ -5072,7 +5072,7 @@ async function ccCall(message, { store = 'cc', sessionKey, extraContext, label =
       outOfBandOnly: !resumeNeedsCarryover,
     }), '', {
       timeout, label, model, maxTurns, allowedTools, sessionId, effort: ccEffort, direct: true,
-      engineConfig: CONFIG.engine, images,
+      engineConfig: CONFIG.engine, invocationScope: 'cc', images,
     });
     if (onAbortReady) onAbortReady(p1.abort);
     result = await p1;
@@ -5110,7 +5110,7 @@ async function ccCall(message, { store = 'cc', sessionKey, extraContext, label =
   const freshPrompt = buildPrompt({ includeCarryover: freshNeedsCarryover });
   const p2 = llm.callLLM(freshPrompt, systemPrompt, {
     timeout, label, model, maxTurns, allowedTools, effort: ccEffort, direct: true,
-    engineConfig: CONFIG.engine, images,
+    engineConfig: CONFIG.engine, invocationScope: 'cc', images,
   });
   if (onAbortReady) onAbortReady(p2.abort);
   result = await p2;
@@ -5128,7 +5128,7 @@ async function ccCall(message, { store = 'cc', sessionKey, extraContext, label =
   await new Promise(r => setTimeout(r, 2000));
   const p3 = llm.callLLM(freshPrompt, systemPrompt, {
     timeout, label, model, maxTurns, allowedTools, effort: ccEffort, direct: true,
-    engineConfig: CONFIG.engine, images,
+    engineConfig: CONFIG.engine, invocationScope: 'cc', images,
   });
   if (onAbortReady) onAbortReady(p3.abort);
   result = await p3;
@@ -5220,7 +5220,7 @@ async function ccCallStreaming(message, { store = 'cc', sessionKey, extraContext
       outOfBandOnly: !resumeNeedsCarryover,
     }), '', {
       timeout, label, model, maxTurns, allowedTools, sessionId, effort: ccEffort, direct: true,
-      engineConfig: CONFIG.engine,
+      engineConfig: CONFIG.engine, invocationScope: 'cc',
       onChunk,
       onToolUse,
       onToolUpdate,
@@ -5259,7 +5259,7 @@ async function ccCallStreaming(message, { store = 'cc', sessionKey, extraContext
   const freshPrompt = buildPrompt({ includeCarryover: freshNeedsCarryover });
   const p2 = llm.callLLMStreaming(freshPrompt, systemPrompt, {
     timeout, label, model, maxTurns, allowedTools, effort: ccEffort, direct: true,
-    engineConfig: CONFIG.engine,
+    engineConfig: CONFIG.engine, invocationScope: 'cc',
     onChunk,
     onToolUse,
     onToolUpdate,
@@ -5280,7 +5280,7 @@ async function ccCallStreaming(message, { store = 'cc', sessionKey, extraContext
   if (onRetry) onRetry(3);
   const p3 = llm.callLLMStreaming(freshPrompt, systemPrompt, {
     timeout, label, model, maxTurns, allowedTools, effort: ccEffort, direct: true,
-    engineConfig: CONFIG.engine,
+    engineConfig: CONFIG.engine, invocationScope: 'cc',
     onChunk,
     onToolUse,
     onToolUpdate,
@@ -9895,7 +9895,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         label, model, maxTurns,
         allowedTools: 'Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch',
         effort, direct: true,
-        engineConfig: CONFIG.engine,
+        engineConfig: CONFIG.engine, invocationScope: 'cc',
       });
       llm.trackEngineUsage(label, result.usage);
 
@@ -9985,7 +9985,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       timeout: CC_CALL_TIMEOUT_MS, label: 'command-center', model, maxTurns,
       allowedTools: 'Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch',
       sessionId: directSessionId, effort, direct: true,
-      engineConfig, images,
+      engineConfig, images, invocationScope: 'cc',
       onProgress: () => _touchCcLiveStream(liveState),
       onChunk: (text, segmentId) => {
         if (liveState.statusMessage) {
@@ -11406,6 +11406,10 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           else if (valid.includes(e.copilotStreamMode)) _setEngineConfig('copilotStreamMode', e.copilotStreamMode);
           else _clamped.push(`copilotStreamMode: "${e.copilotStreamMode}" not in [on, off] (kept previous value)`);
         }
+        if (e.codexCcSandbox !== undefined) {
+          if (_isClear(e.codexCcSandbox)) _deleteEngineConfig('codexCcSandbox');
+          else _setEngineConfig('codexCcSandbox', shared.validateCodexSandbox(e.codexCcSandbox));
+        }
         // W-mpmwxkrw000872ec — fontSize allowlist. Clamps invalid values
         // (rather than silently failing) so the dashboard bootstrap never
         // ends up with an unknown data-font-size attribute.

package/docs/command-center.md

@@ -6,6 +6,24 @@ CC is intentionally a thin wrapper around the runtime CLI: state changes happen
 
 For canonical detail (system prompt, session lifecycle, turn-ID surfacing pipeline, doc-chat integration, and CC API contract), read [`CLAUDE.md`](../CLAUDE.md) — see the **CC API Contract** and **Sessions** sections — and the source in [`dashboard/js/command-center.js`](../dashboard/js/command-center.js), [`dashboard.js`](../dashboard.js) (`handleCommandCenter`), and [`prompts/cc-system.md`](../prompts/cc-system.md).
 
+## Codex sandbox policy
+
+Codex-backed Command Center and doc-chat calls default to
+`engine.codexCcSandbox: "danger-full-access"`. This elevated interactive policy
+lets CC reach the dashboard's localhost APIs and operator-authorized paths
+outside `~/.minions`; it does not grant blanket permission for unsolicited
+writes, which remain governed by the CC system prompt and the
+[operator-checkout write authority](#operator-checkout-write-authority-interactive-turns)
+rules below.
+
+The setting accepts `read-only`, `workspace-write`, or `danger-full-access` and
+is available under **Settings → Advanced → Codex Tuning**. It is scoped by the
+runtime invocation, not by the selected model: dispatched Codex agents and
+non-CC direct calls still default to `workspace-write`, while Claude and Copilot
+arguments are unchanged. The Codex adapter emits an explicit `--sandbox` flag;
+an explicit invocation-level sandbox takes precedence over this engine default
+and the CLI flag intentionally wins over Codex config-file values.
+
 ## Error surfacing contract (W-mpmwxni2000c25c7-d)
 
 Both CC and Doc-Chat emit a typed error envelope so the dashboard can render a red `.cc-error` bubble (role=alert) with a Retry button and stop the spinner immediately. Errors arrive in two shapes:

package/docs/runtime-adapters.md

@@ -263,6 +263,26 @@ Tests in `test/unit/runtime-fleet-helpers.test.js` enforce that
 `resolveAgentCli` does NOT fall through to `engine.ccCli` and that `resolveCcCli`
 does NOT inspect any agent settings.
 
+### Codex sandbox boundary
+
+Codex uses separate sandbox policies for the two runtime paths:
+
+- Command Center and doc-chat calls carry `invocationScope: 'cc'`. The Codex
+  adapter resolves `engine.codexCcSandbox`, which defaults to
+  `danger-full-access`. Interactive CC needs this access to call the localhost
+  Minions API and to write paths the operator explicitly authorizes outside
+  `~/.minions`.
+- Dispatched agents and every other Codex invocation omit the CC scope, so
+  `codex.buildArgs()` retains its `workspace-write` default. Changing
+  `engine.codexCcSandbox` cannot broaden an agent dispatch.
+
+Accepted values are `read-only`, `workspace-write`, and `danger-full-access`;
+the Settings API rejects anything else with HTTP 400. An explicit
+invocation-level `sandbox` option takes precedence over the engine setting.
+The adapter always renders the resolved policy as Codex's `--sandbox` CLI flag,
+which intentionally takes precedence over sandbox values from Codex config
+files.
+
 ## `--cli` / `--model` / `--effort` Knobs
 
 Three CLI flags switch the fleet without dashboard interaction. They are parsed

package/engine/llm.js

@@ -737,6 +737,7 @@ function callLLM(promptText, sysPromptText, opts = {}) {
     // Cross-runtime + Copilot opts:
     maxBudget, bare, fallbackModel,
     stream, disableBuiltinMcps, reasoningSummaries,
+    invocationScope,
     // P-7b2e4d01 — optional image attachments: [{ mimeType, dataBase64, filename? }]
     images,
   } = opts;
@@ -752,7 +753,7 @@ function callLLM(promptText, sysPromptText, opts = {}) {
     model, maxTurns, allowedTools, effort, sessionId,
     maxBudget, bare, fallbackModel, images: imageGate.images,
     stream, disableBuiltinMcps, reasoningSummaries,
-  }, { engineConfig: engineConfig || {} });
+  }, { engineConfig: engineConfig || {}, invocationScope });
 
   let _abort = null;
   const promise = new Promise((resolve) => {
@@ -865,6 +866,7 @@ function callLLMStreaming(promptText, sysPromptText, opts = {}) {
     model: modelOverride, cli: cliOverride, engineConfig,
     maxBudget, bare, fallbackModel,
     stream, disableBuiltinMcps, reasoningSummaries,
+    invocationScope,
     // P-7b2e4d01 — optional image attachments: [{ mimeType, dataBase64, filename? }]
     images,
   } = opts;
@@ -880,7 +882,7 @@ function callLLMStreaming(promptText, sysPromptText, opts = {}) {
     model, maxTurns, allowedTools, effort, sessionId,
     maxBudget, bare, fallbackModel, images: imageGate.images,
     stream, disableBuiltinMcps, reasoningSummaries,
-  }, { engineConfig: engineConfig || {} });
+  }, { engineConfig: engineConfig || {}, invocationScope });
 
   let _abort = null;
   const promise = new Promise((resolve) => {

package/engine/runtimes/codex.js

@@ -11,7 +11,13 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { execFileSync, execSync } = require('child_process');
-const { FAILURE_CLASS, safeWrite, ts, resolveEngineCacheDir } = require('../shared');
+const {
+  FAILURE_CLASS,
+  safeWrite,
+  ts,
+  resolveEngineCacheDir,
+  resolveCodexCcSandbox,
+} = require('../shared');
 
 const ENGINE_DIR = __dirname.replace(/[\\/]runtimes$/, '');
 const MINIONS_DIR = path.resolve(ENGINE_DIR, '..');
@@ -388,6 +394,18 @@ function buildSpawnFlags(opts = {}) {
   return flags;
 }
 
+function resolveInvocationOptions({
+  options = {},
+  engineConfig = {},
+  invocationScope,
+} = {}) {
+  const resolved = { ...options };
+  if (invocationScope === 'cc' && resolved.sandbox == null) {
+    resolved.sandbox = resolveCodexCcSandbox(engineConfig);
+  }
+  return resolved;
+}
+
 function buildPrompt(promptText, sysPromptText, opts = {}) {
   const user = promptText == null ? '' : String(promptText);
   if (opts && opts.sessionId) return user;
@@ -967,6 +985,7 @@ module.exports = {
   spawnScript: path.join(ENGINE_DIR, 'spawn-agent.js'),
   installHint: INSTALL_HINT,
   buildSpawnFlags,
+  resolveInvocationOptions,
   buildArgs,
   buildPrompt,
   getUserAssetDirs,

package/engine/shared.js

@@ -2867,6 +2867,29 @@ function validateLiveValidation(value, opts) {
 // Single source of truth for engine configuration defaults.
 // Used by: engine.js, minions.js (init). config.template.json only has the project schema.
 
+const CODEX_SANDBOX_MODES = Object.freeze([
+  'read-only',
+  'workspace-write',
+  'danger-full-access',
+]);
+
+function validateCodexSandbox(value) {
+  if (value === undefined || value === null || value === '') return undefined;
+  if (typeof value !== 'string' || !CODEX_SANDBOX_MODES.includes(value)) {
+    throw _httpError(400,
+      `Invalid codexCcSandbox: "${value}". Accepted values: ${CODEX_SANDBOX_MODES.map(v => `'${v}'`).join(', ')}.`);
+  }
+  return value;
+}
+
+function resolveCodexCcSandbox(engine) {
+  const configured = engine && engine.codexCcSandbox;
+  if (configured === undefined || configured === null || configured === '') {
+    return ENGINE_DEFAULTS.codexCcSandbox;
+  }
+  return validateCodexSandbox(configured);
+}
+
 const ENGINE_DEFAULTS = {
   // W-mpxpckey000laa4f: tick interval lowered 60s → 10s so the shipped default
   // matches what operators already run at (live boxes have had `tickInterval:
@@ -3289,6 +3312,7 @@ const ENGINE_DEFAULTS = {
   defaultModel: undefined,       // fleet-wide model; undefined = let the runtime adapter pick its own default
   ccCli: undefined,              // CC/doc-chat CLI override; undefined = inherit defaultCli (independent of agent path)
   ccModel: undefined,            // CC/doc-chat model override; undefined = inherit defaultModel
+  codexCcSandbox: 'danger-full-access', // Codex CC/doc-chat only. Dispatched agents and other Codex calls keep the adapter's workspace-write default.
   claudeBareMode: false,         // Claude --bare: suppress CLAUDE.md auto-discovery (per-agent override: agents.<id>.bareMode)
   claudeFallbackModel: undefined,// Claude --fallback-model — Claude CLI honors this on rate-limit (429) only; engine retry on FAILURE_CLASS.MODEL_UNAVAILABLE keeps the flag passed so the CLI can swap internally
   copilotFallbackModel: undefined,// W-mpg6isvy000xca4d: Copilot has no --fallback-model flag; engine retry on FAILURE_CLASS.MODEL_UNAVAILABLE OVERRIDES --model directly with this value (separate knob from claudeFallbackModel because model namespaces differ across runtimes)
@@ -8806,6 +8830,9 @@ module.exports = {
   classifyInboxItem,
   isEngineSystemAlert,
   ENGINE_DEFAULTS,
+  CODEX_SANDBOX_MODES,
+  validateCodexSandbox,
+  resolveCodexCcSandbox,
   resolvePollFlag, // P-c4d8e1a3 — granular per-poller flag resolution
   resolveAgentCli, resolveCcCli, resolveCcUseWorkerPool, resolveAgentUseWorkerPool, resolveAgentAcpPoolSize, resolveAgentModel, resolveCcModel,
   resolveAgentAllowedTools, resolveAgentMaxBudget, resolveAgentBareMode, resolvePropagateClaudeMdForNonClaudeRuntimes,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2421",
+  "version": "0.1.2422",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"